@reclaimprotocol/attestor-core 5.0.1-beta.2 → 5.0.1-beta.22

package/lib/server/utils/process-handshake.js

@@ -1,233 +1,215 @@
-import {
-  concatenateUint8Arrays,
-  getSignatureDataTls12,
-  getSignatureDataTls13,
-  PACKET_TYPE,
-  parseCertificates,
-  parseClientHello,
-  parseServerCertificateVerify,
-  parseServerHello,
-  processServerKeyShare,
-  SUPPORTED_RECORD_TYPE_MAP,
-  uint8ArrayToDataView,
-  verifyCertificateChain,
-  verifyCertificateSignature
-} from "@reclaimprotocol/tls";
+import { concatenateUint8Arrays, getSignatureDataTls12, getSignatureDataTls13, PACKET_TYPE, parseCertificates, parseClientHello, parseServerCertificateVerify, parseServerHello, processServerKeyShare, SUPPORTED_RECORD_TYPE_MAP, uint8ArrayToDataView, verifyCertificateChain, verifyCertificateSignature } from '@reclaimprotocol/tls';
 import { TranscriptMessageSenderType } from "../../proto/api.js";
 import { decryptDirect } from "../../utils/index.js";
 const RECORD_LENGTH_BYTES = 3;
-async function processHandshake(receipt, logger) {
-  const certificates = [];
-  const handshakeRawMessages = [];
-  let currentPacketIdx = 0;
-  let cipherSuite = void 0;
-  let tlsVersion = void 0;
-  let serverRandom = void 0;
-  let clientRandom = void 0;
-  let serverFinishedIdx = -1;
-  let clientFinishedIdx = -1;
-  let certVerified = false;
-  let certVerifyHandled = false;
-  let hostname = void 0;
-  let clientChangeCipherSpecMsgIdx = -1;
-  let serverChangeCipherSpecMsgIdx = -1;
-  let incompletePkt = void 0;
-  while (serverFinishedIdx < 0 || clientFinishedIdx < 0) {
-    const packetIdx = currentPacketIdx++;
-    if (packetIdx >= receipt.length) {
-      throw new Error(
-        "Receipt over but server finish: " + serverFinishedIdx + ", client finish: " + clientFinishedIdx
-      );
-    }
-    const { message, reveal, sender } = receipt[packetIdx];
-    if (message[0] === PACKET_TYPE["CHANGE_CIPHER_SPEC"]) {
-      if (sender === TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT) {
-        clientChangeCipherSpecMsgIdx = packetIdx;
-        logger.trace("found client change cipher spec message");
-      } else {
-        serverChangeCipherSpecMsgIdx = packetIdx;
-        logger.trace("found server change cipher spec message");
-      }
-      continue;
-    }
-    let plaintext = getWithoutHeader(message);
-    if (!plaintext) {
-      throw new Error("incomplete TLS record encountered");
+/**
+ * Verifies server cert chain and removes handshake messages from transcript
+ * @param receipt
+ * @param logger
+ */
+export async function processHandshake(receipt, logger) {
+    const certificates = [];
+    const handshakeRawMessages = [];
+    let currentPacketIdx = 0;
+    let cipherSuite = undefined;
+    let tlsVersion = undefined;
+    let serverRandom = undefined;
+    let clientRandom = undefined;
+    let serverFinishedIdx = -1;
+    let clientFinishedIdx = -1;
+    let certVerified = false;
+    let certVerifyHandled = false;
+    let hostname = undefined;
+    let clientChangeCipherSpecMsgIdx = -1;
+    let serverChangeCipherSpecMsgIdx = -1;
+    let incompletePkt = undefined;
+    while (serverFinishedIdx < 0 || clientFinishedIdx < 0) {
+        const packetIdx = currentPacketIdx++;
+        if (packetIdx >= receipt.length) {
+            throw new Error('Receipt over but server finish: ' + serverFinishedIdx
+                + ', client finish: ' + clientFinishedIdx);
+        }
+        const { message, reveal, sender } = receipt[packetIdx];
+        // skip change cipher spec message
+        if (message[0] === PACKET_TYPE['CHANGE_CIPHER_SPEC']) {
+            if (sender === TranscriptMessageSenderType
+                .TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT) {
+                clientChangeCipherSpecMsgIdx = packetIdx;
+                logger.trace('found client change cipher spec message');
+            }
+            else {
+                serverChangeCipherSpecMsgIdx = packetIdx;
+                logger.trace('found server change cipher spec message');
+            }
+            continue;
+        }
+        let plaintext = getWithoutHeader(message);
+        if (!plaintext) {
+            throw new Error('incomplete TLS record encountered');
+        }
+        if (
+        // decrypt if wrapped record or after change cipher spec message,
+        // after which records are encrypted
+        message[0] === PACKET_TYPE['WRAPPED_RECORD']
+            || (serverChangeCipherSpecMsgIdx > 0
+                && sender === TranscriptMessageSenderType
+                    .TRANSCRIPT_MESSAGE_SENDER_TYPE_SERVER)
+            || (clientChangeCipherSpecMsgIdx > 0
+                && sender === TranscriptMessageSenderType
+                    .TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT)) { // encrypted
+            if (!tlsVersion || !cipherSuite) {
+                throw new Error('Could not find cipherSuite to use & got enc record');
+            }
+            if (!reveal?.directReveal?.key) {
+                throw new Error('no direct reveal for handshake packet: ' + packetIdx);
+            }
+            const recordHeader = message.slice(0, 5);
+            ({ plaintext } = await decryptDirect(reveal?.directReveal, cipherSuite, recordHeader, tlsVersion, plaintext));
+            if (tlsVersion === 'TLS1_3') {
+                plaintext = plaintext.slice(0, -1);
+            }
+        }
+        if (incompletePkt) {
+            const incSender = receipt[incompletePkt.packetIdx].sender;
+            if (incSender !== sender) {
+                throw new Error('Missing follow up to incomplete packet at idx: '
+                    + incompletePkt.packetIdx);
+            }
+            plaintext = concatenateUint8Arrays([
+                incompletePkt.remainingBytes,
+                plaintext
+            ]);
+            incompletePkt = undefined;
+        }
+        const handshakeMessages = [];
+        // each handshake packet may contain multiple handshake messages
+        for (let offset = 0; offset < plaintext.length;) {
+            const type = plaintext[offset];
+            // +1 for the record type byte
+            const content = readWithLength(plaintext.slice(offset + 1), RECORD_LENGTH_BYTES);
+            if (!content) {
+                incompletePkt = {
+                    remainingBytes: plaintext.slice(offset),
+                    packetIdx,
+                };
+                break;
+            }
+            handshakeMessages.push({
+                type,
+                content,
+                contentWithHeader: plaintext.slice(offset, offset + 1 + RECORD_LENGTH_BYTES + content.length),
+                packetIdx,
+            });
+            offset += 1 + RECORD_LENGTH_BYTES + content.length;
+        }
+        for (const msg of handshakeMessages) {
+            await processHandshakeMessage(msg);
+            handshakeRawMessages.push(msg.contentWithHeader);
+        }
     }
-    if (
-      // decrypt if wrapped record or after change cipher spec message,
-      // after which records are encrypted
-      message[0] === PACKET_TYPE["WRAPPED_RECORD"] || serverChangeCipherSpecMsgIdx > 0 && sender === TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_SERVER || clientChangeCipherSpecMsgIdx > 0 && sender === TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT
-    ) {
-      if (!tlsVersion || !cipherSuite) {
-        throw new Error("Could not find cipherSuite to use & got enc record");
-      }
-      if (!reveal?.directReveal?.key) {
-        throw new Error(
-          "no direct reveal for handshake packet: " + packetIdx
-        );
-      }
-      const recordHeader = message.slice(0, 5);
-      ({ plaintext } = await decryptDirect(
-        reveal?.directReveal,
-        cipherSuite,
-        recordHeader,
-        tlsVersion,
-        plaintext
-      ));
-      if (tlsVersion === "TLS1_3") {
-        plaintext = plaintext.slice(0, -1);
-      }
+    if (!certVerified) {
+        throw new Error('No provider certificates received');
     }
-    if (incompletePkt) {
-      const incSender = receipt[incompletePkt.packetIdx].sender;
-      if (incSender !== sender) {
-        throw new Error(
-          "Missing follow up to incomplete packet at idx: " + incompletePkt.packetIdx
-        );
-      }
-      plaintext = concatenateUint8Arrays([
-        incompletePkt.remainingBytes,
-        plaintext
-      ]);
-      incompletePkt = void 0;
+    if (tlsVersion === 'TLS1_3' && serverFinishedIdx < 0) {
+        throw new Error('server finished message not found');
     }
-    const handshakeMessages = [];
-    for (let offset = 0; offset < plaintext.length; ) {
-      const type = plaintext[offset];
-      const content = readWithLength(plaintext.slice(offset + 1), RECORD_LENGTH_BYTES);
-      if (!content) {
-        incompletePkt = {
-          remainingBytes: plaintext.slice(offset),
-          packetIdx
-        };
-        break;
-      }
-      handshakeMessages.push({
-        type,
-        content,
-        contentWithHeader: plaintext.slice(
-          offset,
-          offset + 1 + RECORD_LENGTH_BYTES + content.length
-        ),
-        packetIdx
-      });
-      offset += 1 + RECORD_LENGTH_BYTES + content.length;
+    if (tlsVersion === 'TLS1_3' && !certVerifyHandled) {
+        throw new Error('TLS1.3 cert verify packet not received');
     }
-    for (const msg of handshakeMessages) {
-      await processHandshakeMessage(msg);
-      handshakeRawMessages.push(msg.contentWithHeader);
+    if (tlsVersion === 'TLS1_2' && (serverChangeCipherSpecMsgIdx < 0 || clientChangeCipherSpecMsgIdx < 0)) {
+        throw new Error('change cipher spec message not found');
     }
-  }
-  if (!certVerified) {
-    throw new Error("No provider certificates received");
-  }
-  if (tlsVersion === "TLS1_3" && serverFinishedIdx < 0) {
-    throw new Error("server finished message not found");
-  }
-  if (tlsVersion === "TLS1_3" && !certVerifyHandled) {
-    throw new Error("TLS1.3 cert verify packet not received");
-  }
-  if (tlsVersion === "TLS1_2" && (serverChangeCipherSpecMsgIdx < 0 || clientChangeCipherSpecMsgIdx < 0)) {
-    throw new Error("change cipher spec message not found");
-  }
-  const nextMsgIndex = Math.max(serverFinishedIdx, clientFinishedIdx) + 1;
-  return {
-    tlsVersion,
-    cipherSuite,
-    hostname,
-    nextMsgIndex
-  };
-  async function processHandshakeMessage({ type, content, contentWithHeader, packetIdx }) {
-    switch (type) {
-      case SUPPORTED_RECORD_TYPE_MAP.CLIENT_HELLO:
-        const clientHello = parseClientHello(contentWithHeader);
-        clientRandom = clientHello.serverRandom;
-        const { SERVER_NAME: sni } = clientHello.extensions;
-        hostname = sni?.serverName;
-        if (!hostname) {
-          throw new Error("client hello has no SNI");
-        }
-        break;
-      case SUPPORTED_RECORD_TYPE_MAP.SERVER_HELLO:
-        const serverHello = await parseServerHello(content);
-        cipherSuite = serverHello.cipherSuite;
-        tlsVersion = serverHello.serverTlsVersion;
-        serverRandom = serverHello.serverRandom;
-        logger.info(
-          { serverTLSVersion: tlsVersion, cipherSuite },
-          "extracted server hello params"
-        );
-        break;
-      case SUPPORTED_RECORD_TYPE_MAP.CERTIFICATE:
-        const parseResult = parseCertificates(content, { version: tlsVersion });
-        certificates.push(...parseResult.certificates);
-        await verifyCertificateChain(certificates, hostname, logger);
-        logger.info({ hostname }, "verified provider certificate chain");
-        certVerified = true;
-        break;
-      case SUPPORTED_RECORD_TYPE_MAP.CERTIFICATE_VERIFY:
-        const signature = parseServerCertificateVerify(content);
-        if (!certificates?.length) {
-          throw new Error("No provider certificates received");
+    const nextMsgIndex = Math.max(serverFinishedIdx, clientFinishedIdx) + 1;
+    return {
+        tlsVersion: tlsVersion,
+        cipherSuite: cipherSuite,
+        hostname: hostname,
+        nextMsgIndex,
+    };
+    async function processHandshakeMessage({ type, content, contentWithHeader, packetIdx }) {
+        switch (type) {
+            case SUPPORTED_RECORD_TYPE_MAP.CLIENT_HELLO:
+                const clientHello = parseClientHello(contentWithHeader);
+                clientRandom = clientHello.serverRandom;
+                const { SERVER_NAME: sni } = clientHello.extensions;
+                hostname = sni?.serverName;
+                if (!hostname) {
+                    throw new Error('client hello has no SNI');
+                }
+                break;
+            case SUPPORTED_RECORD_TYPE_MAP.SERVER_HELLO:
+                const serverHello = await parseServerHello(content);
+                cipherSuite = serverHello.cipherSuite;
+                tlsVersion = serverHello.serverTlsVersion;
+                serverRandom = serverHello.serverRandom;
+                logger.info({ serverTLSVersion: tlsVersion, cipherSuite }, 'extracted server hello params');
+                break;
+            case SUPPORTED_RECORD_TYPE_MAP.CERTIFICATE:
+                const parseResult = parseCertificates(content, { version: tlsVersion });
+                certificates.push(...parseResult.certificates);
+                await verifyCertificateChain(certificates, hostname, logger);
+                logger.info({ hostname }, 'verified provider certificate chain');
+                certVerified = true;
+                break;
+            case SUPPORTED_RECORD_TYPE_MAP.CERTIFICATE_VERIFY:
+                const signature = parseServerCertificateVerify(content);
+                if (!certificates?.length) {
+                    throw new Error('No provider certificates received');
+                }
+                const signatureData = await getSignatureDataTls13(handshakeRawMessages, cipherSuite);
+                await verifyCertificateSignature({
+                    ...signature,
+                    publicKey: certificates[0].getPublicKey(),
+                    signatureData,
+                });
+                certVerifyHandled = true;
+                break;
+            case SUPPORTED_RECORD_TYPE_MAP.SERVER_KEY_SHARE:
+                if (!certificates?.length) {
+                    throw new Error('No provider certificates received');
+                }
+                const keyShare = await processServerKeyShare(content);
+                const signatureData12 = await getSignatureDataTls12({
+                    clientRandom: clientRandom,
+                    serverRandom: serverRandom,
+                    curveType: keyShare.publicKeyType,
+                    publicKey: keyShare.publicKey,
+                });
+                // verify signature
+                await verifyCertificateSignature({
+                    signature: keyShare.signatureBytes,
+                    algorithm: keyShare.signatureAlgorithm,
+                    publicKey: certificates[0].getPublicKey(),
+                    signatureData: signatureData12,
+                    publicKeyType: keyShare.publicKeyType
+                });
+                await verifyCertificateChain(certificates, hostname, logger);
+                logger.info({ hostname }, 'verified provider certificate chain');
+                certVerified = true;
+                break;
+            case SUPPORTED_RECORD_TYPE_MAP.FINISHED:
+                const packet = receipt[packetIdx];
+                if (packet.sender === TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT) {
+                    clientFinishedIdx = packetIdx;
+                }
+                else {
+                    serverFinishedIdx = packetIdx;
+                }
+                break;
         }
-        const signatureData = await getSignatureDataTls13(
-          handshakeRawMessages,
-          cipherSuite
-        );
-        await verifyCertificateSignature({
-          ...signature,
-          publicKey: certificates[0].getPublicKey(),
-          signatureData
-        });
-        certVerifyHandled = true;
-        break;
-      case SUPPORTED_RECORD_TYPE_MAP.SERVER_KEY_SHARE:
-        if (!certificates?.length) {
-          throw new Error("No provider certificates received");
-        }
-        const keyShare = await processServerKeyShare(content);
-        const signatureData12 = await getSignatureDataTls12(
-          {
-            clientRandom,
-            serverRandom,
-            curveType: keyShare.publicKeyType,
-            publicKey: keyShare.publicKey
-          }
-        );
-        await verifyCertificateSignature({
-          signature: keyShare.signatureBytes,
-          algorithm: keyShare.signatureAlgorithm,
-          publicKey: certificates[0].getPublicKey(),
-          signatureData: signatureData12,
-          publicKeyType: keyShare.publicKeyType
-        });
-        await verifyCertificateChain(certificates, hostname, logger);
-        logger.info({ hostname }, "verified provider certificate chain");
-        certVerified = true;
-        break;
-      case SUPPORTED_RECORD_TYPE_MAP.FINISHED:
-        const packet = receipt[packetIdx];
-        if (packet.sender === TranscriptMessageSenderType.TRANSCRIPT_MESSAGE_SENDER_TYPE_CLIENT) {
-          clientFinishedIdx = packetIdx;
-        } else {
-          serverFinishedIdx = packetIdx;
-        }
-        break;
     }
-  }
 }
 function getWithoutHeader(message) {
-  return readWithLength(message.slice(3), 2);
+    // strip the record header (xx 03 03 xx xx)
+    return readWithLength(message.slice(3), 2);
 }
 function readWithLength(data, lengthBytes = 2) {
-  const dataView = uint8ArrayToDataView(data);
-  const length = lengthBytes === 1 ? dataView.getUint8(0) : dataView.getUint16(lengthBytes === 3 ? 1 : 0);
-  if (data.length < lengthBytes + length) {
-    return void 0;
-  }
-  return data.slice(lengthBytes, lengthBytes + length);
+    const dataView = uint8ArrayToDataView(data);
+    const length = lengthBytes === 1
+        ? dataView.getUint8(0)
+        : dataView.getUint16(lengthBytes === 3 ? 1 : 0);
+    if (data.length < lengthBytes + length) {
+        return undefined;
+    }
+    return data.slice(lengthBytes, lengthBytes + length);
 }
-export {
-  processHandshake
-};

package/lib/server/utils/proxy-session.js

@@ -1,6 +1,6 @@
-function isValidProxySessionId(sessionId) {
-  return typeof sessionId === "string" && sessionId.length >= 8 && sessionId.length < 15 && /^[a-z0-9]+$/.test(sessionId);
+export function isValidProxySessionId(sessionId) {
+    return typeof sessionId === 'string'
+        && sessionId.length >= 8
+        && sessionId.length < 15
+        && /^[a-z0-9]+$/.test(sessionId);
 }
-export {
-  isValidProxySessionId
-};

package/lib/server/utils/tee-oprf-mpc-verification.js

@@ -1,86 +1,90 @@
+/**
+ * TEE OPRF MPC Verification
+ * Verifies OPRF MPC outputs from TEE_K and TEE_T match
+ *
+ * Unlike ZK OPRF which requires proof verification, OPRF MPC outputs
+ * are already trusted because they are included in TEE-signed payloads.
+ * This module verifies that both TEEs computed identical outputs.
+ */
 import { AttestorError } from "../../utils/error.js";
-function verifyOprfMpcOutputs(kPayload, tPayload, logger) {
-  const kOutputs = kPayload.oprfOutputs || [];
-  const tOutputs = tPayload.oprfOutputs || [];
-  if (kOutputs.length === 0 && tOutputs.length === 0) {
-    logger.debug("No OPRF MPC outputs to verify");
-    return [];
-  }
-  if (kOutputs.length !== tOutputs.length) {
-    throw new AttestorError(
-      "ERROR_INVALID_CLAIM",
-      `OPRF MPC count mismatch: TEE_K has ${kOutputs.length}, TEE_T has ${tOutputs.length}`
-    );
-  }
-  logger.info(`Verifying ${kOutputs.length} OPRF MPC outputs`);
-  const results = [];
-  for (const [i, kOut] of kOutputs.entries()) {
-    const tOut = tOutputs[i];
-    if (kOut.tlsStart < 0 || tOut.tlsStart < 0) {
-      throw new AttestorError(
-        "ERROR_INVALID_CLAIM",
-        `OPRF MPC invalid position at index ${i}: negative start position`
-      );
+/**
+ * Verifies OPRF MPC outputs from TEE_K and TEE_T match
+ * Returns verified outputs for transcript replacement (same format as ZK OPRF)
+ */
+export function verifyOprfMpcOutputs(kPayload, tPayload, logger) {
+    const kOutputs = kPayload.oprfOutputs || [];
+    const tOutputs = tPayload.oprfOutputs || [];
+    // Empty is valid - no OPRF MPC was requested
+    if (kOutputs.length === 0 && tOutputs.length === 0) {
+        logger.debug('No OPRF MPC outputs to verify');
+        return [];
     }
-    if (kOut.tlsLength <= 0 || kOut.tlsLength > 64 || tOut.tlsLength <= 0 || tOut.tlsLength > 64) {
-      throw new AttestorError(
-        "ERROR_INVALID_CLAIM",
-        `OPRF MPC invalid length at index ${i}: must be 1-64 bytes (TEE_K: ${kOut.tlsLength}, TEE_T: ${tOut.tlsLength})`
-      );
+    // Count must match between TEE_K and TEE_T
+    if (kOutputs.length !== tOutputs.length) {
+        throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC count mismatch: TEE_K has ${kOutputs.length}, TEE_T has ${tOutputs.length}`);
     }
-    if (kOut.hashOutput.length !== 32 || tOut.hashOutput.length !== 32) {
-      throw new AttestorError(
-        "ERROR_INVALID_CLAIM",
-        `OPRF MPC invalid hash size at index ${i}: expected 32 bytes (TEE_K: ${kOut.hashOutput.length}, TEE_T: ${tOut.hashOutput.length})`
-      );
+    logger.info(`Verifying ${kOutputs.length} OPRF MPC outputs`);
+    const results = [];
+    for (const [i, kOut] of kOutputs.entries()) {
+        const tOut = tOutputs[i];
+        // Validate position bounds (must be non-negative)
+        if (kOut.tlsStart < 0 || tOut.tlsStart < 0) {
+            throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC invalid position at index ${i}: negative start position`);
+        }
+        // Validate length constraints (must be positive and <= 64 bytes, matching TEE validation)
+        if (kOut.tlsLength <= 0 || kOut.tlsLength > 64 || tOut.tlsLength <= 0 || tOut.tlsLength > 64) {
+            throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC invalid length at index ${i}: must be 1-64 bytes ` +
+                `(TEE_K: ${kOut.tlsLength}, TEE_T: ${tOut.tlsLength})`);
+        }
+        // Validate hash output size (must be exactly 32 bytes for SHA256)
+        if (kOut.hashOutput.length !== 32 || tOut.hashOutput.length !== 32) {
+            throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC invalid hash size at index ${i}: expected 32 bytes ` +
+                `(TEE_K: ${kOut.hashOutput.length}, TEE_T: ${tOut.hashOutput.length})`);
+        }
+        // Verify positions match
+        if (kOut.tlsStart !== tOut.tlsStart || kOut.tlsLength !== tOut.tlsLength) {
+            throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC position mismatch at index ${i}: ` +
+                `TEE_K [${kOut.tlsStart}:${kOut.tlsStart + kOut.tlsLength}] vs ` +
+                `TEE_T [${tOut.tlsStart}:${tOut.tlsStart + tOut.tlsLength}]`);
+        }
+        // Verify hash outputs match (hash = SHA256(CMAC), so this implies CMAC matched too)
+        if (!buffersEqual(kOut.hashOutput, tOut.hashOutput)) {
+            throw new AttestorError('ERROR_INVALID_CLAIM', `OPRF MPC hash mismatch at index ${i}: outputs differ between TEE_K and TEE_T`);
+        }
+        // Log the actual output data for debugging
+        const hashOutputHex = Buffer.from(kOut.hashOutput).toString('hex');
+        const hashOutputBase64 = Buffer.from(kOut.hashOutput).toString('base64');
+        logger.info({
+            index: i,
+            position: kOut.tlsStart,
+            length: kOut.tlsLength,
+            hashOutputLen: kOut.hashOutput.length,
+            hashOutputHex: hashOutputHex.substring(0, 32) + '...',
+            hashOutputBase64Preview: hashOutputBase64.substring(0, 20) + '...'
+        }, 'OPRF MPC output verified');
+        // Return in same format as ZK OPRF for unified replacement
+        // MPC OPRF uses full hash length (not truncated like TOPRF)
+        results.push({
+            position: kOut.tlsStart,
+            length: kOut.tlsLength,
+            output: new Uint8Array(kOut.hashOutput), // Use SHA256(CMAC) as the replacement value
+            isMPC: true
+        });
     }
-    if (kOut.tlsStart !== tOut.tlsStart || kOut.tlsLength !== tOut.tlsLength) {
-      throw new AttestorError(
-        "ERROR_INVALID_CLAIM",
-        `OPRF MPC position mismatch at index ${i}: TEE_K [${kOut.tlsStart}:${kOut.tlsStart + kOut.tlsLength}] vs TEE_T [${tOut.tlsStart}:${tOut.tlsStart + tOut.tlsLength}]`
-      );
-    }
-    if (!buffersEqual(kOut.hashOutput, tOut.hashOutput)) {
-      throw new AttestorError(
-        "ERROR_INVALID_CLAIM",
-        `OPRF MPC hash mismatch at index ${i}: outputs differ between TEE_K and TEE_T`
-      );
-    }
-    const hashOutputHex = Buffer.from(kOut.hashOutput).toString("hex");
-    const hashOutputBase64 = Buffer.from(kOut.hashOutput).toString("base64");
-    logger.info(
-      {
-        index: i,
-        position: kOut.tlsStart,
-        length: kOut.tlsLength,
-        hashOutputLen: kOut.hashOutput.length,
-        hashOutputHex: hashOutputHex.substring(0, 32) + "...",
-        hashOutputBase64Preview: hashOutputBase64.substring(0, 20) + "..."
-      },
-      "OPRF MPC output verified"
-    );
-    results.push({
-      position: kOut.tlsStart,
-      length: kOut.tlsLength,
-      output: new Uint8Array(kOut.hashOutput),
-      // Use SHA256(CMAC) as the replacement value
-      isMPC: true
-    });
-  }
-  logger.info(`Successfully verified ${results.length} OPRF MPC outputs`);
-  return results;
+    logger.info(`Successfully verified ${results.length} OPRF MPC outputs`);
+    return results;
 }
+/**
+ * Compare two Uint8Array buffers for equality
+ */
 function buffersEqual(a, b) {
-  if (a.length !== b.length) {
-    return false;
-  }
-  for (const [i, element] of a.entries()) {
-    if (element !== b[i]) {
-      return false;
+    if (a.length !== b.length) {
+        return false;
+    }
+    for (const [i, element] of a.entries()) {
+        if (element !== b[i]) {
+            return false;
+        }
     }
-  }
-  return true;
+    return true;
 }
-export {
-  verifyOprfMpcOutputs
-};